U.S. Pat. No. 5,224,453 discloses a method and an arrangement for controlling a drive unit of a motor vehicle. Here, at least one operating variable of the drive unit or of the motor vehicle is detected utilizing two mutually redundant measuring devices. The drive unit is controlled in dependence upon at least one of the two detected measured variables. The detected operating variable is especially the position of an operator-controlled element for controlling the power of the drive unit. The operator-controlled element is actuable by the driver. The power of the drive unit is controlled by adjusting at least one power parameter in dependence upon one of the measured signal quantities which represents the extent of the actuation of the operator-controlled element by the driver and therefore the driver's request for power. To ensure operational safety and operability of the control of the drive unit, the first measured signal quantity is compared to the second measured signal quantity, which is detected by the redundant measuring device. If the two measured signal quantities deviate impermissibly from each other, then a fault state is detected in the area of measurement value detection and, if necessary, an emergency operation of the control is initiated. In the preferred embodiment, this synchronous monitoring is carried out only in selected value ranges of the operating variable, such as above the idle range.
When comparing the two signal values to each other, a maximum synchronous tolerance must be considered between the two measuring devices. This means that the monitoring only then responds in the sense of the fault detection when the two signal values differ from each other by more than the maximum synchronous tolerance. In the value ranges in which the monitoring is not carried out or with lower sensitivity, the synchronous tolerance applied outside of this value range does not apply.
The signal of one of the measuring devices is used as a so-called lead variable for controlling the drive unit. When there is a transition from the range without synchronous monitoring into the range with synchronous monitoring, the fault monitoring only responds when the lead variable has moved away from the range boundary by the amount of the synchronous tolerance.
If the measuring devices are connected to the accelerator pedal, then a signal, which corresponds to the driver command, is derived from the lead measuring device. For this purpose, a scale point is determined from which a fuel command of the driver can be assumed. This scale point, at which the pedal angle is assumed to be 0, is fixed when leaving the idle point while considering the synchronism tolerance. Accordingly, a fault condition can only then be detected from a comparison of the two signal values when the lead measuring device has already moved by the synchronism tolerance in the region wherein a gas command of the driver is assumed. This means that, in the case of an actual fault, the drive unit is first controlled in the sense of a power increase until the signal of the lead variable has exceeded the scaling point by the synchronism tolerance.
A corresponding situation also occurs when the synchronism monitoring is active. Here too, it can occur that a measurement signal moves defectively within the synchronism tolerance because of drift without a fault being detected. A fault detection here too also only takes place when the tolerance is exceeded.